Privacy Policy
Last updated: 23 October 2026 (interim correction; a full version is being prepared)
1. Who we are
The controller of the personal data collected at madeirainvestment.org is Madeira Investment, with registered office at Rua Cônego Alfredo César Oliveira, n.º 10, 1.º Esq., Santa Cruz, Funchal 9100-153, Portugal. For any privacy question, please contact us at info@madeirainvestment.org.
2. What data we collect
| Situation | Data |
|---|---|
| Company diagnostic (European Expansion Map) | Name, job title, email, phone (optional), company name and website, country, answers about the company (stage, sector, team, revenue, capital, goals and timelines), the description of your plan for Europe, if you choose to share it, and the company presentation you attach. |
| Ambassador Programme application | Name, email, country, phone (optional), LinkedIn profile and answers about your profile and network. |
| Ambassador agreement | Full name, identification document, address, country and the record of the electronic signature (date, time, IP address, browser and agreement version). |
| Browsing the website | Technical data and cookies (see section 8) and the source of the visit (for example, an Ambassador’s or a campaign’s code). |
| Contact and online shop | The data you send us by email, phone or form, and the data needed for orders in the online shop. |
3. Why we use the data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Calculating and sending the result of the diagnostic or application and responding to your request, including booking a session | Steps taken at your request prior to entering into a contract (Art. 6(1)(b)) |
| Recording internally and analysing the answers and documents of the company diagnostic, by our team and by potential investor partners, to assess the project as a possible Madeira Investment portfolio company | Steps taken at your request prior to entering into a contract, with the authorisation you give in the form (Art. 6(1)(b)) |
| Managing the agreement and the Ambassador Programme, including the attribution of companies and the calculation of commissions | Performance of a contract (Art. 6(1)(b)) |
| Sending news about European expansion, funding and events and, for the company diagnostic, contacting you by email, phone, WhatsApp or video call to continue the assessment of the project (optional box in the form) | Consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Knowing where contacts come from (campaigns and Ambassadors) and improving our service | Legitimate interest (Art. 6(1)(f)) |
| Website usage statistics (Google Analytics), to understand how the website is used and to improve it | Consent, given in the cookie banner, which you can withdraw at any time (Art. 6(1)(a)) |
| Complying with legal, tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
4. Automated assessment of your answers
The diagnostic and the application calculate a preliminary score from your answers, using fixed rules. This score and the European Expansion Map report, generated from the same answers, shape the content you receive and the order in which our team reviews contacts. It is a preliminary assessment and does not constitute a decision on investment, funding or eligibility. You can always ask for your case to be reviewed by a member of our team by writing to info@madeirainvestment.org.
5. Who we share the data with
We do not sell personal data. Data is processed by providers acting on our behalf:
- Hostinger: hosting of the website, contact database and email. Some pages also load a small script from the Hostinger Reach service (subscription forms), which uses your browser’s local storage;
- Automattic (Akismet): spam filtering of forms. It receives the data submitted in the form, the IP address and browser details, and may process them outside the European Economic Area under standard contractual clauses;
- Google (YouTube): on the home page only, when the video loads. Google may use its own cookies;
- Google (Google Analytics): website usage statistics, only if you accept statistics cookies. It receives technical data about the visit (pages viewed, where the visit came from, device and browser type, approximate country or city, cookie identifiers). Google Analytics 4 does not store the full IP address. Google may process this data outside the European Economic Area under standard contractual clauses and the EU–US Data Privacy Framework. We do not link Analytics to advertising;
- api.qrserver.com: generates the Ambassadors’ QR code image (it only receives the Ambassador’s public link);
- potential investor partners of Madeira Investment: for the company diagnostic, the answers and the attached presentation, shared confidentially and solely so that they can assess the project, with the authorisation you give in the form;
- Madeira Investment partners (for example, legal, accounting or funding partners), only when needed for the service you requested and with your prior knowledge.
Except for the virtual assistants (section 5-A), if any of these providers processes data outside the European Economic Area, it does so with the safeguards provided for in the GDPR (for example, standard contractual clauses).
5-A. Virtual assistants (artificial intelligence)
The website’s virtual assistants are artificial intelligence systems, not people. They are optional: the diagnostic and contact with our team do not depend on them. The answers are automated, may contain errors and do not constitute legal, tax or investment advice. Please do not share confidential information in the conversations.
“Priscilla” avatar (in testing)
The photo of the “Priscilla” avatar, provided by Crypken / Avatr Sdn Bhd (Malaysia), appears in the bottom right corner of the pages. Until you interact with it, nothing is loaded from the provider. When you click the photo (or, on a computer, hover over it), the avatar loads from the provider’s servers (including Amazon Web Services in Singapore), which receive your IP address and technical browser data. If you press “Hold to talk”, your voice is recorded and sent to the provider to be converted into text and answered.
Conversation avatar on ElevenLabs (companies that take the diagnostic)
To every company that takes the diagnostic we offer, on the result screen and in the email, an optional conversation with the Madeira Investment virtual assistant, which takes place on the ElevenLabs website. You can chat by text or voice and attach files. The assistant may ask questions about your company (for example, project, market, team and revenue) and ask for your contact details, so that our team can prepare to contact you. The conversation (the text and, if you use voice, the recording) is recorded on the ElevenLabs service and can be viewed by the Madeira Investment team. Before you start, the ElevenLabs page asks you to accept the service terms, including the recording.
ElevenLabs processes this data on our behalf. According to the ElevenLabs privacy policy, the data is stored in the United States, with transfers under the EU-U.S. Data Privacy Framework or standard contractual clauses.
We are finalising with these two providers the data processing agreements and the safeguards required by the GDPR for transfers outside the European Economic Area, and defining how long conversations are kept.
6. How long we keep the data
- Diagnostics and applications with no business relationship: 24 months after the last contact;
- Clients, Ambassador agreements and signature records: for the duration of the relationship and the legal retention period (10 years);
- Marketing communications: until you withdraw your consent;
- Attached company presentations: 12 months, unless there is a business relationship.
7. Your rights
You can request access to, rectification, erasure, restriction or portability of your data, object to processing based on legitimate interest and withdraw your consent at any time (without affecting processing carried out before then). Every newsletter email includes a link to unsubscribe. To exercise your rights, write to info@madeirainvestment.org; we will reply within one month at the latest. You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).
8. Cookies and similar technologies
We use cookies and local storage that are necessary for the website to work (for example, session, language and shop cart). In addition:
- the YouTube video on the home page is a third-party service that may store information in your browser;
- the virtual assistants (section 5-A) are third-party services that, only once you open them, may store information in your browser;
- we store in your browser, for up to 90 days, the Ambassador or campaign code through which you arrived, to attribute your request correctly.
Statistics cookies (Google Analytics): they are only switched on if you click «Accept» in the banner. Until you accept, or if you reject, Google Analytics does not store cookies in your browser and only receives anonymous signals, without identifiers, which Google uses for aggregated estimates (Google Consent Mode). The cookies used are _ga and _ga_XXY65QZ6XJ, which last up to 2 years.
Your choice is stored for 365 days in the necessary cookies cmplz_* and wp_consent_*. You can change it at any time in the «Manage consent» tab in the corner of the screen. You can also delete cookies in your browser settings. Fonts are served from our own website.
To improve the European Expansion Map page, we anonymously count visits, assessment starts and submissions, the step at which each visit stopped, and the source of the visit (e.g. LinkedIn). We do not use cookies for this or store data that identifies the visitor.
9. Security
We apply technical and organisational measures to protect the data, including encrypted connections (HTTPS) and access to the data and attached files restricted to our team and, for the company diagnostic, to the potential investor partners with whom they are shared for assessment.
10. Changes to this policy
We may update this policy. The version in force is always on this page, with the date of the last update.